Know when your stack has a hole before someone else does
You shipped an app with an AI tool and it has real users. VibeBeacon keeps a list of the runtimes, frameworks and packages it runs on, and emails you when a flaw lands on a version you actually use, with the command that fixes it.
One app free, forever. No card. We never ask for access to your code, your host or your database.
How it works
Three steps, then it runs on its own
The whole setup is one command or one paste. After that the only thing you do is read email.
- 1
Run one command, or paste a prompt
The CLI reads your package files and lockfiles and writes a short list of what your app runs on. If your tool has no shell, paste our prompt and it writes the same list for you.
- 2
We watch those versions
We pull advisories from OSV, GitHub, the NVD, the CISA exploited list and vendor feeds every half hour, then match them against the exact versions you run.
- 3
You get an email with the fix
One email per problem that actually affects you, with the upgrade command to run. Everything else waits for the digest.
Data
What we store, and what we never see
If our database leaked tomorrow, an attacker would learn that an email address runs Next.js 15.1 on Vercel. That is the whole design.
What we store
- Package names and the exact versions you run
- Ecosystem for each package, such as npm or PyPI
- Runtime and framework versions, such as Node 22.11.0 and Next 15.1.0
- Hosting provider names, such as Vercel or Fly
- Service names, such as Stripe or Supabase
- Your email address and your app names
What we never see
- Your source code. Not one line of it
- Your .env files. The CLI refuses to open them
- API keys, tokens, passwords or connection strings
- File paths, repo URLs or database names
- Your customers, your data or your traffic
- Any access to your GitHub, your host or your database
The privacy page shows the exact JSON we receive, field by field.
Setup
Pick the path that suits your tool
All three produce the same file. Use whichever your editor supports.
Run this in your project folder. It reads package files and lockfiles, strips anything that looks sensitive, and uploads the list.
npx vibebeacon@latest scan --uploadCLI
One command in your project folder. Reads lockfiles, strips anything sensitive, uploads the result.
Read morePrompt
Paste a prompt into Cursor, Claude Code, Lovable, Bolt or v0. It builds the file for you, shell or no shell.
Read moreMCP
Add our MCP server to your editor and ask it to scan and upload. It can also read back your open alerts.
Read moreThe alert
This is what arrives
One problem per email, in plain English, with the command to run. Everything below your threshold waits for the digest.
From VibeBeacon <alerts@vibebeacon.app>
To you@example.com
High severity: next 15.1.0 in My Coffee Shop POS
Your app My Coffee Shop POS runs next 15.1.0. A flaw in the middleware path lets a request skip authorisation checks. It is fixed in 15.2.3.
Run this
npm install next@15.2.3Same major version, so no breaking changes are expected.
Detected 4 minutes after the advisory was published.
Pricing
Your first app is free. Every app after that is two dollars a month.
No tiers. The free app gets every feature. Five apps costs USD $8 a month, because one of them is free.
Your first app
Free
No card needed, no time limit
- One app, watched the same way as a paid one
- Instant email on high and critical advisories
- Daily or weekly digest, your choice
- Full alert history
- API and MCP access
Every app after that
Most peopleUSD $2
per app per month, billed monthly
- Same features. You are only paying for another app
- One subscription, one line, the count follows your active apps
- Add an app and Stripe charges the pro-rata difference
- Pause or archive an app and the next invoice drops
- Cancel any time from the billing page
VibeBeacon is a new company. Plans and prices may change. If a change affects your subscription we will email you before it takes effect.
Work out your cost with the calculatorQuestions
Straight answers
What exactly do you store about my app?
Package names, versions, ecosystem, runtimes, frameworks, hosting provider names and service names. No code, no paths, no env values, no keys, no repo URLs. The CLI refuses to read .env files, and the server rejects any manifest that contains something secret-shaped.
How do you keep the list fresh without access to my repo?
Three ways, cheapest first. We email you when a manifest is older than 30 days. The CLI has a --watch flag. And there is a GitHub Action snippet that runs the scan on every push. A read-only GitHub App that reads package files only is planned as an opt-in later.
What if I cannot run a shell, like on Lovable, v0 or Bolt?
Use the no-shell prompt. It asks your AI tool to write the JSON by hand from package.json and the lockfile. Versions from ranges are less precise, so we mark those entries unresolved and match conservatively.
How much email will I get?
By default, an instant email only for high and critical problems that match an exact version you run. Everything else goes into a daily digest, and news items are batched weekly. You can raise or lower the threshold per app, and dev-only dependencies are suppressed by default. This is the same on a free app and a paid one.
What does it cost?
Your first app is free and it gets every feature. Each app after that is USD $2 per month, billed monthly. Five apps is USD $8 a month, because one of the five is free. Adding an app bumps the count on one subscription and Stripe prorates it. VibeBeacon is a new company. Plans and prices may change. If a change affects your subscription we will email you before it takes effect.
Who is this for?
Solo builders and small teams who shipped something with Cursor, Claude Code, Lovable or Bolt and now have paying users but no security process. You do not read GitHub advisories. You want one email that says upgrade next to 15.2.3, here is the command.
Why should I trust you?
Our privacy page shows the exact JSON we receive. The CLI is open source so you can read what it collects. The dashboard has a page that shows everything we hold on each app, and a button that deletes the lot. We never ask for OAuth access to your code, your host or your database.
How is this different from Dependabot?
Dependabot needs access to your repo and opens pull requests. We watch runtimes, hosting providers and services as well as packages, add end-of-life warnings and exploited-in-the-wild flags, map vendor news to your stack, and write the fix in plain English for people who did not write the code themselves. You can run both.
Add your first app in about two minutes
Sign in with a link or with GitHub, create an API key, run one command. If nothing in your stack is affected, you hear nothing until something is.